Man with a handgun
Fatal flaws in your active shooter response plan & how to fix them

Consider the following scenario. Jennifer is your best employee. She has been working for you for 10 years. She has earned 10 outstanding, annual performance reviews. She comes in early, she gets her work done and she never whines. We know little about Jennifer’s personal life because she only focuses on her work. There is no frivolous chatter or family drama played out at work. It is part of what makes Jennifer the perfect employee. Over the years, we have learned that Jennifer has two young children and she is married to Joe. We have met Joe at a couple of company social events over the last 10 years, but we know little about Jennifer’s family life. Turns out, Joe is a monster. He beats Jennifer, and he abuses the children. Joe is so hostile that Jennifer has sued for divorce, and she is currently going through an ugly custody battle. It has become so violent that Jennifer has secured a court-ordered protection decree against Joe being anywhere near her and the kids, whether at home or at your workplace. But we know nothing of these troubles because Jennifer doesn’t bring family drama to work. This morning, though, Joe shows up at your reception desk. He is carrying a huge bouquet of flowers. Knowing nothing of their troubles at home, you give Joe immediate, unescorted access to your workplace. He goes down your hall, finds Jennifer, drops the flowers, produces a pistol and shoots Jennifer. What do you do right now? You’re standing 10 feet away, or you are sitting in a conference room nearby. You are the receptionist, the human resources director, the safety manager or the CEO. How do you react? If you freeze, you are the next victim. If they are untrained, your people will also freeze. As the employer, you have ultimately abandoned your untrained employees to the active shooter.

One Degree of Separation

This is called intimate partner violence (IPV), a term used and researched by the federal government. The United States Department of Justice (DOJ) reports that, today, two employees will be murdered in the American workplace, as they are every workday on average. IPV kills 1,300 people annually—mostly women in a similar scenario to the one we just witnessed. Twenty-six women will be raped in the next 60 minutes in the American workplace. There are not six degrees of separation in workplace violence. There is only one degree of separation: either you will know the shooter or you will know his/her target.

Your Duty of Care

As the employer, under law, you have an affirmative duty of care to keep all of your employees safe during any emergency involving an active shooter. Your duty of care is manifested by an emergency action plan that includes workplace violence (WPV) and an active shooter that you have trained to all employees—not just you and your safety committee. All employees should be trained and refreshed yearly on your plan. Absent plans and annual training, you, as the employer, will be found negligent, and thereby held responsible civilly and potentially criminally.

Fatal Flaw

So what is the fatal flaw in your response? Whether you have a plan or not, the fatal flaw in your thinking is this: almost all of these incidents are over in 4 to 8 minutes, according to the New York Police Department and the FBI. The majority of active shooters have finished their actions in under 4 minutes. Thus, there is no time to convene, and there is no time for advice. Every one of your employees needs to know what to do in a quarter-second. Success occurs only if you have carefully planned and trained all of your people. In this situation, the police, firemen and emergency medical technicians (EMTs) are not the first responders. They are the official responders. Your employees are actually the first responders. It is always an employee who first sees the smoke, the fire, the spill or, in this case, the active shooter. Thus, every one of your employees has to be trained to respond immediately to any emergency.



Workplace Violence Myths

Too many leaders in workplaces just like yours harbor myths about WPV that promote the lack of planning and training. They say things like:

  • “It can’t happen here.”
  • “Educated people are not violent.”
  • “Talking about violence will make it happen.”
  • “If a person can joke about violence, they won’t become violent.”
  • “People who threaten violence are just looking for attention.”

All of these are myths to which most management clings, thereby thwarting plan creation and employee training. Yes, you may already have a WPV policy. But, no, you have not created structured response procedures. And, you have never trained your employees on those procedures. Colliding with your workplace’s denial is a dramatic increase in these active shooter incidents. Before the Sandy Hook massacre in Newtown, Connecticut, in December 2012, the FBI measured that one or more employees were killed in workplace active shooter incidents once a month on average. Since Sandy Hook, it is now one a week. From 2013 to 2016, these active shooter incidents have quadrupled. For your workplace and employees, this kind of emergency is real. OSHA has an impressive array of regulations regarding every workplace’s obligation to create emergency plans and train them.

The Responsible Party

If you are the CEO, you are the responsible party at your workplace, or so says the Supreme Court of the United States (SCOTUS) in two decisions. Both cases came to the court regarding a CEO’s failure to implement federal safety regulations. Both CEOs plead to the court that they were busy and had delegated these responsibilities to subordinates best able to address them. In both cases, SCOTUS found the CEOs liable civilly, personally and criminally. Applying these SCOTUS decisions, in 2015 and 2016, prosecutors in California, Pennsylvania, West Virginia and New York City criminally indicted seven CEOs of companies where employees were killed on the job. Five of those CEOs are now serving prison terms. The other two CEOs are going to trial shortly. In 2015, the U.S. DOJ announced that it has created a Memorandum of Understanding (MOU) with OSHA to pursue criminal prosecution of CEOs regarding OSHA regulations. DOJ’s preferred legal weapon is to investigate and charge CEOs with obstruction of justice (18 U.S.C. 1805). Turns out, previous OSHA compliance investigations have been obstructed by senior managers by withholding documents, telling employees to lie and also lying themselves. DOJ calls this obstruction of justice punishable by up to 5 years in federal prison. This is easily proven once DOJ issues a subpoena and search warrant implemented at your workplace by the FBI.

Fix Your Fatal Flaws

As the employer, you have a way out of all this. Create a written plan, and then train your employees. That sounds simple enough, but nothing in emergency response is simple. Many experts, including the Department of Homeland Security (DHS), recommend “RUN.HIDE.FIGHT.” This is a memorable and effective response protocol for all your employees. Run means to absent yourself from the emergency because that is the safest strategy. Hide means a lockdown, and fight should be used as a last resort when all else fails. None of this is simple, and all of it must be site specific. Training “RUN.HIDE.FIGHT” has to be careful and tactical.

Active Shooter Protocol

To layer on more complexity, your employees must know how to work with arriving police. Calling 911 and then stepping back is a fatal flaw. This dangerous myth will delay response, potentially multiplying the casualties in your workplace. While your employees are always the first responders, their roles do not end when police arrive. The active shooter protocol in your jurisdiction starts with, “Go into your building. Find guy with gun. Kill him.” Thus, your employees’ roles are to:



  1. Report the latest information to police as they arrive on the scene.
  2. Offer maps of your facility to guide police in pursuit of the active shooter.
  3. As officers move through your facility, know that they are not priests. You must train your people to refrain from touching or yelling at police to appeal for help. They are also not EMTs. If you or a coworker is bleeding out, officers will keep moving. Their job is to find the guy with the gun and kill him.
  4. All of your people will be ordered to raise their hands. This to demonstrate to police that each of your people has no weapon. Remember, since police do not know the good from the bad guys, everyone is considered a suspect or an accomplice. You must aid police in identifying friend from foe. To complete this phase, police will search everyone on the premises.
  5. Police will order all personnel to carry nothing with them and drop in place whatever they are carrying. That means leaving your bag, cell phone, briefcase or any other personal items. All personal items, as well as people, will be searched.

As the employer, your job is to train all employees regarding how police will take command of your facility. Officers will be focused on the active shooter. Your job is to aid them by continuing to command, control and communicate with the help of your personnel. You will need to conduct a headcount. Required by federal law, this headcount will aid police commanders in understanding the scope of the carnage as quickly as possible. All of these first responses need to start in seconds and end within minutes. Thus, careful planning and sharp tactical training of your personnel is essential to limit casualties in this situation. Read part 2 of this series here.